Manifest fields
The canonical manifest uses version 1, the stable legacy wire product identity, kind: extension_manifest_v1, extension_id, semantic release, positive sequence and root_sequence, UTC issued_at/expires_at, inclusive minimum_panel_version, exclusive maximum_panel_version_exclusive, api_version: 1, os: linux, architecture: amd64, entrypoint: bin/extension, sorted permissions, sorted files and optional publisher-signed orbit_addon.
Do not rename stable signature/product wire values to match a new display brand. The exact domain separation and canonical JSON are part of verification; obtain them from the matching approved SDK/release rather than handcrafting a signature.
Inventory and time bounds
Metadata is at most 128 KiB. A package has 1–256 inventoried files, at most 128 MiB total, each nonempty and at most 64 MiB. Each file record has exact path, bytes, SHA-256 and mode. The sole executable is bin/extension mode 0755. Allowed assets/ and notices/ members are 0644 with the validated JSON/text/PNG/SVG/CSS extensions and safe path components. Absolute paths, traversal, links and uninventoried executable inputs are not accepted.
Manifest validity is at most 31 days and rejects future issuance beyond the permitted clock skew; root validity is at most 366 days. The publisher root has purpose extensions, positive sequence, sorted distinct Ed25519 keys and threshold within its key count, at most 16 keys. The envelope requires the threshold of valid canonical signatures from that independent root. Version bounds and exact root sequence are enforced.
Permissions and sandbox
Only resources:read and operations:read are supported manifest permissions, 1–2 sorted unique entries. The root-controlled registered runner verifies protected package descriptors, UID/mode, confinement and service prerequisites before launching unprivileged code. No manifest permission authorizes root, arbitrary network, another tenant's files or a privileged agent operation. Asset files in a signed package do not become trusted Panel HTML.
Runner command contract
The command accepts --extension with the registered signed ID and optional --check-premium; positional arguments are rejected. Check-premium reports version, extension ID, active status and checked time only after current verification, without executing the child. Obtain the exact installed executable and systemd registration from the approved kit. The internal child mode is not an operator integration interface.
Premium marker and trust separation
orbit_addon contains format: 1, product_code: panel, reviewed addon UUID; the surrounding release is its addon version. Editing/removing it invalidates publisher signatures. Protected orbit_main and the existing installation-key credential establish current main rights separately. A package cannot choose its own authority trust or install a publisher root. Native production recovery/root/publisher acceptance remains pending and must not be implied by source validation.